Modules

Two neighbours answer different questions: Architecture has the dependency graph and what imports what, and Reference is the Doxygen tree, where the struct members and constant values live.

• boot-probe.pyPhase 1 check: the boot shim must never cost the twin its self-test.
• iframe-checks.pyTwo Activity checklist items that only mean anything inside an iframe.
• participants-test.mjsHostile-input test for the "N watching" strip.
• verify-deploy.mjsCheck that what a host actually serves is what we built.
• write-lock.mjsRegenerate activity/twin.lock.json from the current web-twin/ sources.

• discord-boot.tsDiscord Activity boot shim for the openaliro web twin.
• participants.ts"N watching": free social presence, no backend.

• vite.config.ts

• chunk-kconfig.ts@file A grammar-aware chunker for Kconfig fragments, and the experiment that
• corpus.ts@file What gets indexed, and how it is cut up for the Stage 0 baseline.
• deepwiki.ts@file Baseline A: DeepWiki, scored against the same golden set.
• expand.ts@file The vocabulary alias table, and query expansion over it.
• golden.ts@file The golden set, and the gate that keeps its labels honest.
• headers.ts@file §7.2 tier 1: a deterministic keyword header on every chunk.
• independent.ts@file Validate and score a golden set this session did not write.
• retrieve.ts@file The two lexical retrievers Stage 0 measures, over one shared tokenizer.
• scope.ts
• score-deepwiki.ts@file Re-score the cached DeepWiki answers, with a metric that is fair to prose.
• stage0.ts@file Stage 0 baseline D: the lexical floor, measured.
• stage1-probe.ts@file Which candidate fix actually moves the config stratum?

• 0001_rigs.sql
• 0002_matrix_cooldowns.sql
• 0003_test_requests.sql
• 0004_validations.sql
• 0005_oauth.sql
• 0006_handled_interactions.sql
• 0007_build_cooldowns.sql

• build-size-baseline.ts@file Regenerate src/size-baseline.generated.ts from firmware/size-baseline.json.
• build-spec-index.ts@file Regenerate src/spec-index.generated.ts from the live docs/ tree.
• check-citations.ts@file The drift gate.
• drift.ts@file The drift gate's logic, with no filesystem in it.
• generate-assets.ts@file Regenerates src/assets.generated.ts from the vendored font files and
• register-commands.ts@file Upload the command list to Discord.
• register-role-metadata.ts@file Registers this application's Linked Roles metadata schema (a
• size-baseline-extract.ts@file The extraction logic, separate from the file I/O in
• spec-scan.ts
• twin-wasm-extract.ts@file Extract the WASM module embedded in web-twin/twin.js into src/twin.wasm.

• api.ts@file The two Discord calls that need the bot token.
• assets.generated.ts
• assets.ts@file Decodes the generated base64 assets into bytes, once per Worker
• attest.ts@file Look up a GitHub build-provenance attestation by subject digest.
• awake.ts@file Whether a registered owner is awake right now, from their stored
• boards.ts@file The enums a contributor picks from: board, radio, NFC front-end, and
• build-targets.ts@file The targets choices firmware-builds.yml actually accepts.
• citations.ts@file The triage table. Every answer this bot gives comes from here.
• command.ts@file The shape every command file exports: a Discord command definition
• cooldown.ts@file The /matrix PNG-rendering cooldown.
• db.ts@file Interaction idempotency and the /build cooldown.
• discord.ts@file Wire constants and response builders for the Discord interactions
• discordOAuth.ts@file The Discord half of Linked Roles: authorize URL, the two OAuth2
• discordRest.ts@file The handful of Discord REST calls that need a bot token rather than
• env.ts@file Worker bindings.
• followup.ts@file Deferring, and the edit that finishes a deferred command.
• githubOAuth.ts@file The GitHub half of Linked Roles. It verifies the account, not the
• images.ts@file The images somebody can be running.
• index.ts@file The interactions endpoint.
• linkedRoles.ts@file Orchestrates the Linked Roles flow across the three plain browser
• maintainer.ts@file The maintainer allow-list, shared by every maintainer-only command
• matrix.ts@file The compatibility matrix: pure formatting, no D1 and no Discord
• modal.ts@file Modal building and parsing.
• oauthLinks.ts@file Every statement this Worker runs against oauth_links. Same rule
• oauthState.ts@file The CSRF/session-correlation state that chains the two OAuth legs
• render.ts@file The compatibility matrix, as a PNG.
• rigs.ts@file Every statement this Worker runs against D1.
• roleConnection.ts@file Linked Roles metadata: the five fields the spec suggests
• scheduled.ts@file The escalation sweep: "asleep candidates get pinged on a follow-up
• signatures.ts@file The console-output matcher.
• size-baseline.generated.ts@file Generated by scripts/build-size-baseline.ts. Do not hand-edit.
• size-baseline.ts@file The recorded CDK size baseline, as six numbers.
• spec-index.generated.ts@file Generated by scripts/build-spec-index.ts. Do not hand-edit.
• testRequestContainer.ts@file The /test-request status card, and the one-time ping that goes
• testRequests.ts@file Every statement this Worker runs against test_requests and
• tokenCipher.ts@file AES-256-GCM for the one thing this bot stores that is a real bearer
• twin-js.d.ts@file Ambient type for the relative import of ../../web-twin/twin.js.
• twin.ts@file Runs the compiled woz_uwb digital twin inside this Worker.
• validations.ts@file Every statement this Worker runs against validations. Same rule
• verify.ts@file Ed25519 verification of Discord interaction requests.
• wasm-module.d.ts@file Ambient type for a static .wasm module import.

• build.ts@file /build <target> — dispatch firmware-builds.yml.
• context.ts@file /context — the firmware-side make doctor the tree does not have.
• decode-devid.ts@file /decode-devid — the most common bring-up failure.
• forget.ts@file /forget — hard delete.
• help-me.ts@file /help-me — collect the context once, match it, escalate honestly.
• ihave.ts@file /ihave — register hardware.
• index.ts@file The command table.
• matrix.ts@file /matrix — the compatibility matrix.
• ping.ts@file /ping — the liveness check.
• size.ts@file /size — the current recorded CDK size baseline.
• spec.ts@file /spec <section> — which files in this repository cite an Aliro 1.0
• test-request.ts@file /test-request board: ios: what: — maintainer-only.
• test-result.ts@file /test-result pass|fail — run inside the claim thread, by whoever
• twin.ts@file /twin approach and /twin explain — the WASM digital twin, run inside this Worker.
• verify.ts@file /verify <sha256> — attestation lookup by subject digest.
• who-has.ts@file /who-has — maintainer-only lookup.
• why.ts@file /why — the recurring "is this a bug?" answers.

• aliro_ble_zephyr.c
• aliro_prov_settings.c
• case_bench.c
• dfu_ble_zephyr.c@file
• main.c
• matter_ble_zephyr.c@file matter_ble_zephyr.c — the 0xFFF6 GATT service that carries BTP.
• matter_ble_zephyr.h@file matter_ble_zephyr.h — the 0xFFF6 commissioning transport.
• matter_commission.c@file matter_commission.c — joins BTP, the exchange and PASE.
• matter_commission.h@file matter_commission.h — start answering commissioning attempts.
• matter_fab_settings.c
• matter_fab_settings.h
• matter_thread_port.c@file matter_thread_port.c — matter_thread.h on top of Zephyr's OpenThread.
• prov_shell.c
• status_led.c@file
• thread_gate.c

• presence-enroll
• presence-run
• presence_client.pyClient and command gate for the local presenced Unix socket.
• presence_service.pyFresh, pinned presence proofs behind an owner-only Unix socket.
• presenced

• aliro_mqtt_bridge.pyRepublish the lock's console log to MQTT as Home Assistant entities.

• __init__.pyHA=1-only OpenAliro direct-serial integration.
• config_flow.pyManual direct-serial config flow for the HA=1 OpenAliro beta.
• const.pyConstants for the HA=1 OpenAliro custom integration.
• device_trigger.pyGranted and denied device-automation triggers for OpenAliro access events.
• diagnostics.pyRedacted diagnostics for the HA=1 OpenAliro direct integration.
• event.pyAccess outcome event entity for the HA=1 OpenAliro direct integration.
• runtime.pyHome Assistant runtime bridge over the shared OpenAliro serial session.
• sensor.pyDistance sensor for the HA=1 OpenAliro direct integration.

• ha-setup.shOne command from nothing to a working OpenAliro Home Assistant agent.

• __init__.pyHA=1-only staging library for the OpenAliro Home Assistant adapters.
• __main__.pyModule entry point for the HA=1-only staging command.
• agent.pyRunnable standalone-agent orchestration over the shared serial library.
• cli.pySmall, non-interactive HA=1 staging CLI for safe offline operations.
• compatibility.pyIncremental parser for the source-proven `aliro range` compatibility mode.
• config.pyVersioned, secret-free TOML configuration for the HA=1-only agent.
• models.pyTyped observations emitted by the HA=1 console parser.
• mqtt.pyStandalone MQTT adapter for the HA=1 staging agent.
• parser.pyNarrow parser for the currently verified nRF5340 console output.
• serial_session.pyAsync, transport-neutral ownership of one OpenAliro serial console.
• serial_transport.pypyserial adapter and privacy-safe serial-port identity helpers.

• package_component.pyBuild a local OpenAliro custom-component archive without publishing it.

• aliro_advtag.hAliro BLE advertisement Dynamic Tag derivation (Aliro 1.0 section 11.3.1): the 7-byte
• aliro_approach.h@file aliro_approach.h
• aliro_assert.h
• aliro_assert_ec.h
• aliro_ble.hAliro BLE-UWB reader transport: GATT service definition, advertised feature flags, and transport
• aliro_ble_central.hDevice-side (User-Device) BLE transport interface: the central/client mirror of
• aliro_crypto.hAliro crypto public API: key derivation, AES-GCM secure channels, and wire message
• aliro_device.hAliro initiator (User-Device) session layer: the device-side counterpart of
• aliro_device_apdu.hDevice (User-Device) side of the Aliro Access-Protocol wire codec: the inverse
• aliro_lab.hAliro Lab trace: structured "[ALAB]" lines at transaction phase boundaries,
• aliro_lat.h@file aliro_lat.h
• aliro_prim.h
• aliro_prov.hPersistent reader provisioning storage: identity and credential trust anchors saved to and
• aliro_reader.h
• aliro_rssi_gate.hBLE-RSSI ranging power gate: decides when the phone is close enough that arming
• aliro_stepup.hAliro step-up (Access Document) phase: builds the mdoc DeviceRequest, unwraps and decrypts the

• aliro_advtag.cAliro BLE advertisement Dynamic Tag derivation (Aliro 1.0 section 11.3.1), shared by the
• aliro_apdu.cAliro APDU TLV codec: builds command payloads (AUTH0, AUTH1, AuthData, EXCHANGE) and parses
• aliro_apdu.hAPDU framing and parsing for the Aliro Access Protocol: builds outbound command APDUs via a
• aliro_approach.c@file aliro_approach.c
• aliro_assert.cPresence-assertion wire codec + verifier (see aliro_assert.h). Serialises a
• aliro_assert_ec.cBinds the aliro_assert P-256 seam to aliro_prim's ECDSA (see aliro_assert_ec.h).
• aliro_ble_central.cPlatform-free half of the device-side BLE transport declared in
• aliro_crypto.cAliro cryptographic primitives: key derivation (KDF/HKDF), key-block splitting, AES-GCM secure
• aliro_device.cAliro initiator (User-Device) session machine: the implementation behind
• aliro_device_apdu.cImplementation of the device-side Access-Protocol wire codec declared in
• aliro_hash.cSelf-contained SHA-256, HMAC-SHA256, HKDF, and ANSI-X9.63 KDF implementation for the ESP32-IDF
• aliro_hash.hStreaming SHA-256 (FIPS 180-4) implementation used by the Aliro crypto layer.
• aliro_lat.cWalk-up latency trace: first-hit phase timestamps + the consolidated budget line.
• aliro_prim_psa.cAliro crypto primitive backend implemented on Arm PSA Crypto: random generation, AES-256-GCM
• aliro_prov.cAliro reader provisioning state: default dev identity, and serialization/deserialization of the
• aliro_ranging.cUWB ranging bring-up and lifecycle for the Aliro reader: initializes the reader's UWB
• aliro_ranging.hAliro M1-M4 ranging-setup interface: negotiates UWB ranging parameters with the device and
• aliro_reader.cAliro reader engine: drives the Access Protocol (AUTH0/AUTH1/EXCHANGE) handshake over BLE,
• aliro_rssi_gate.cBLE-RSSI ranging power gate implementation: EWMA smoothing in Q4 fixed point,
• aliro_stepup.cAliro step-up phase codec + verifier: derives the StepUpSK SessionData keys, builds the mdoc
• aliro_stepup_parse.cDeviceResponse structural decoder for the Aliro step-up phase: a minimal, bounds-checked,

• nfc_prop_ecp.cppNFC Type A proprietary callback implementation for Aliro Express unlock (tap-to-unlock without

• advertising_core.c@file advertising_core.c
• advertising_core.hAliro BLE advertising primitives.
• aliro_stack.cppIndependent implementation of the Nordic Aliro public API used by this app.
• session.cpp@file session.cpp

• access_document.c@file access_document.c
• access_document.h@file access_document.h
• ble_message.c@file ble_message.c
• ble_message.hAliro 1.0 Bluetooth LE message framing (section 11.7).
• ble_timeout.c@file ble_timeout.c
• ble_timeout.hAliro 1.0 Bluetooth LE responseTimeout rules (section 11.9).
• nfc_auth.c@file nfc_auth.c
• nfc_auth.hAliro 1.0 expedited authentication APDU codecs.
• nfc_select.c@file nfc_select.c
• nfc_select.h@file nfc_select.h
• nfc_step_up.c@file nfc_step_up.c
• nfc_step_up.hAliro 1.0 / ISO 18013-5 NFC step-up message and APDU codecs.
• tlv.c@file tlv.c
• tlv.hMinimal strict BER/DER-TLV reader for Aliro APDU payloads.

• woz_dfu.h@file
• woz_dfu_rx.h@file

• emit_pubkey.pyEmit the public half of the MCUboot signing key as a C array.

• dfu_applier.c@file
• dfu_receiver.c@file
• dfu_smp_img.c@file

• matter_attest.h@file matter_attest.h — proving to a commissioner that this is a real device.
• matter_btp.h@file matter_btp.h — BTP, the Matter commissioning transport over BLE GATT.
• matter_case.h@file matter_case.h — proving an operational identity, both ways.
• matter_clusters.h@file matter_clusters.h — what this device answers, as opposed to how.
• matter_crypto.h@file matter_crypto.h — Matter message crypto: nonce, AES-CCM, session keys.
• matter_exchange.h@file matter_exchange.h — the unsecured exchange PASE runs on.
• matter_fabric.h@file matter_fabric.h — the operational identity a commissioner installs.
• matter_im.h@file matter_im.h — the Interaction Model, as far as a commissioner needs it.
• matter_mrp.h@file matter_mrp.h — Message Reliability Protocol: backoff, retransmit, dedup.
• matter_msg.h@file matter_msg.h — Matter message header and protocol (exchange) header.
• matter_pase.h@file matter_pase.h — PASE message codec (the five commissioning messages).
• matter_pase_sm.h@file matter_pase_sm.h — PASE responder: the device side of the five messages.
• matter_spake2p.h@file matter_spake2p.h — SPAKE2+ glue: PBKDF2, transcript, confirmations.
• matter_status.h@file matter_status.h — return codes shared by every woz_matter layer.
• matter_thread.h@file matter_thread.h — the seam between a commissioner's dataset and a radio.
• matter_tlv.h@file matter_tlv.h — Matter TLV codec (Matter Core spec, Appendix A).

• matter_attest.c
• matter_btp.c@file matter_btp.c — BTP handshake codec, fragmenter and reassembler.
• matter_case.c
• matter_clusters.c
• matter_crypto.c@file matter_crypto.c — AES-128-CCM, the Matter nonce, and the key schedule.
• matter_exchange.c@file matter_exchange.c — the unsecured exchange. See matter_exchange.h.
• matter_fabric.c
• matter_im.c
• matter_mrp.c@file matter_mrp.c — MRP backoff schedule, retransmit state, replay window.
• matter_msg.c@file matter_msg.c — Matter message and protocol header codec.
• matter_pase.c@file matter_pase.c — PASE message codec over Matter TLV.
• matter_pase_sm.c@file matter_pase_sm.c — PASE responder state machine. See matter_pase_sm.h.
• matter_spake2p.c@file matter_spake2p.c — PBKDF2, the SPAKE2+ transcript and confirmations.
• matter_tlv.c@file matter_tlv.c — Matter TLV codec, encoder then decoder.

• transport.hWoz NFC transport seam.

• pn532.cPN532 host-protocol driver. See pn532.h. OS-free: no Zephyr headers, no
• pn532.hNXP PN532 host-protocol driver: frame codec and the command subset needed by
• pn532_apdu.c@file pn532_apdu.c
• pn532_apdu.hPN532-specific ISO 7816 APDU adaptation.
• pn532_bus.hBus binding for the PN532 driver. One implementation is compiled in per
• pn532_bus_spi.cZephyr SPI glue for the PN532 host protocol.
• transport_none.cppWozNfc backend for boards with no NFC frontend: polling never starts and no
• transport_pn532.cppWozNfc backend driving an NXP PN532 reader.
• transport_rfal.cppWozNfc backend forwarding to the add-on's ST25R/RFAL transport unchanged.

• woz_log.h
• woz_port.h@file woz_port.h

• aliro_device_uwb.cDevice-side UWB ranging-service setup codec: parses the reader's M1 and M3
• aliro_device_uwb.hDevice/initiator side of the UWB ranging-service setup codec: the interface for
• aliro_uwb_adapter.c@file aliro_uwb_adapter.c — reader-context lifecycle.
• aliro_uwb_internal.h@file aliro_uwb_internal.h — private context types and shared helpers.
• aliro_uwb_msg.c@file aliro_uwb_msg.c — setup/notification message codec.
• aliro_uwb_msg.h@file aliro_uwb_msg.h — message framing accessors, dispatch and builders.
• aliro_uwb_msg_builder.c@file aliro_uwb_msg_builder.c — big-endian TLV message builder.
• aliro_uwb_msg_builder.h@file aliro_uwb_msg_builder.h — big-endian TLV message builder.
• aliro_uwb_msg_parser.c@file aliro_uwb_msg_parser.c — TLV attribute parser and big-endian reads.
• aliro_uwb_msg_parser.h@file aliro_uwb_msg_parser.h — TLV attribute iteration and big-endian reads.
• aliro_uwb_msg_spec.h@file aliro_uwb_msg_spec.h — UWB ranging-service framing constants.
• aliro_uwb_session.c@file aliro_uwb_session.c — per-session lifecycle and state machine.

• aliro_uwb_adapter.h@file aliro_uwb_adapter.h — reader-device public interface.
• aliro_uwb_session.h@file aliro_uwb_session.h — per-session public interface.

• cherry.h@file cherry.h — Cherry core (context + device-capabilities) interface.
• cherry_ccc.h@file cherry_ccc.h — CCC/Aliro-session interface (seam the adapter drives).
• cherry_common.h@file cherry_common.h — diagnostics config struct and report forward decl.
• cherry_session.h@file cherry_session.h — generic base-session interface.

• aliro_kdf.h@file aliro_kdf.h — UWB Ranging Secret Key (URSK) length.
• aliro_round_config.h@file aliro_round_config.h — one knob for the CCC ranging round's responder count.
• ccc_crypto_mbedtls.c@file ccc_crypto_mbedtls.c — AES-ECB block via mbedTLS, backing the CCC key schedule on SoCs
• ccc_crypto_psa.c@file ccc_crypto_psa.c — On-target AES-ECB block (PSA/CC312) backing the CCC key schedule.
• ccc_kdf.c@file ccc_kdf.c — UWB key schedule + SP0 Pre-POLL frame codec.
• ccc_kdf.h@file ccc_kdf.h
• ccc_mac.c@file ccc_mac.c — UWB MAC: hopping sequence, SP0 frame codec, ranging schedule.
• ccc_mac.h@file ccc_mac.h — CCC UWB MAC layer: ranging-round scheduling, SP0 frame codec, DS-TWR.
• ccc_session.c@file ccc_session.c — Aliro/CCC ranging seam implementation. See ccc_session.h.
• ccc_session.h@file ccc_session.h — Aliro/CCC ranging seam: map an Aliro session's URSK + M1-M4 setup to
• ccc_shim.c@file ccc_shim.c — CCC STS substitution core (implementation).
• ccc_shim.h@file ccc_shim.h — map a per-frame STS index to the (dURSK, STS-V) pair the DW3000 STS engine
• ccc_shim_rx.c@file ccc_shim_rx.c — responder-RX CCC STS substitution: woz_uwb_arm_rx() programs the CCC STS
• ccc_shim_wrap.c@file ccc_shim_wrap.c — per-frame STS interception: woz_uwb_set_sts_iv() substitutes the CCC STS
• ccc_sts.c@file ccc_sts.c — DW3000 STS register load for the CCC ranging path.
• ccc_sts.h@file ccc_sts.h — load a CCC ranging PPDU's STS key + IV into the DW3000 STS engine.
• cherry_ccc_shim.c@file cherry_ccc_shim.c — cherry_ccc_* seam (Aliro responder) implemented over the lock-native

• uwb_cirdiag.c@file uwb_cirdiag.c — CIA RX-diagnostics latch + [ALAB] emitter (channel-impulse Stage 0/1).
• uwb_isr.c@file uwb_isr.c — DW3000 interrupt-callback registration (implementation).
• uwb_isr.h@file uwb_isr.h — DW3000 interrupt-callback registration (public surface).
• uwb_min.c@file uwb_min.c — DW3110 bring-up driver (implementation).
• uwb_min.h@file uwb_min.h — Minimal DW3110 (DWM3000EVB) hardware bring-up driver.
• uwb_rxdiag.c@file uwb_rxdiag.c — Diagnostic RX/TX event tallies + ranging heartbeat.
• uwb_rxdiag.h@file uwb_rxdiag.h — Read-side accessors for the RX event tallies + log stream.
• uwb_seam.h@file uwb_seam.h — the DW3000 entry points the CCC engine owns.
• uwb_selftest.c@file uwb_selftest.c — Kconfig-gated one-shot UWB init self-test (no iPhone).

• flight_recorder.c@file flight_recorder.c
• flight_recorder.h@file flight_recorder.h
• trace.h@file trace.h — Structured [WOZ_TRACE] emit helpers, gated on CONFIG_WOZ_E2E_TRACE.
• uwb_cirdiag.h@file uwb_cirdiag.h — Per-reception CIA first-path/STS diagnostics stream (channel-impulse
• woz_alloc.hMemory allocation and timing facade: qmalloc, qcalloc, qfree wrap the platform heap;
• woz_bytes.h@file woz_bytes.h
• woz_diag.h@file woz_diag.h — DIAGK(): gate for verbose UWB bring-up diagnostics.
• woz_logfmt.c@file woz_logfmt.c — PRETTY-gated high-res timestamp + compact colored log line.
• woz_logquiet.c@file woz_logquiet.c — PRETTY-gated runtime muting of benign upstream error spam.
• woz_util.h
• woz_uwb_facade.cUWB facade: binds the CCC credential-based STS engine to the DW3000 radio, exposes Aliro DS-TWR
• woz_uwb_facade.hPublic header for UWB facade: exposes Aliro DS-TWR responder lifecycle and range query; the CCC

• fira_device_config.h@file fira_device_config.h — FiRa DS-TWR device/session parameter bag consumed by
• fira_session.c@file fira_session.c — Range + URSK store for the CCC Pre-POLL responder.
• fira_session.h@file fira_session.h — Range + URSK store for the CCC Pre-POLL responder.

• aliro_shell.c@file aliro_shell.c — aliro UART shell command: colored console over the UWB engine.
• aliro_shell.h@file aliro_shell.h — the one seam the aliro console needs from the application.

• main.cESP32-S3 application entry for the Aliro initiator, the User-Device role that

• app_driver.cppBoard driver glue for the ESP32 Matter port: button input, WS2812 lock-status LED, and the
• app_main.cppMatter application main: door lock endpoint setup, Matter lifecycle event handling, and (when
• app_priv.h
• app_shell.cppESP32-IDF console shell for the Aliro Matter door lock app: registers status, range, aliro, lock/unlock, codes, factoryr
• app_shell.h
• ha_mqtt.cNative Home Assistant MQTT publisher for the ESP32 Matter lock — see ha_mqtt.h
• ha_mqtt.h
• lock_led.cLock-state indicator LED: maps lock state (and Aliro activity) to an RGB colour for the single
• lock_led.hLock status LED color mapping: derives the RGB color for the lock indicator from the

• aliro_reader_delegate.cppAliroReaderDelegate: implements the Aliro reader-provisioning and BLE-UWB portions of the Matter
• aliro_reader_delegate.hDeclares AliroReaderDelegate, the Aliro (Apple Home Key) reader-provisioning and BLE-UWB half of
• door_lock_callbacks.cppMatter DoorLock cluster plugin callbacks: wires the ESP32 port's BoltLockManager into the
• door_lock_manager.cppBoltLockManager: Matter door lock cluster backing store for the ESP32 port. Implements the DoorLock cluster's user, cred
• door_lock_manager.hDoor lock manager for the Matter DoorLock cluster: owns bolt lock state plus the users,

• app_shell.cESP32-IDF console shell for the standalone Aliro UWB responder bench app: registers status, range, aliro-start/stop, pro
• app_shell.h
• main.cWoz UWB ranging engine on ESP32 (ESP-IDF) — minimal bring-up app.

• aliro_ble.cNimBLE-backed BLE transport for the Aliro reader: GAP advertising, the Aliro GATT service,

• aliro_ble_central_nimble.cNimBLE central/client backend for the Aliro initiator: the mirror of

• aliro_prov_nvs.cNVS-backed persistence for Aliro reader provisioning: loads and stores the serialized reader
• aliro_stepup_worker.c@file aliro_stepup_worker.c
• presence_link.cPresence dongle commands (see presence_link.h). prove ends every old Aliro
• presence_link.hPresence dongle commands (CONFIG_WOZ_PRESENCE): fresh, challenge-driven signed

• piv_apdu.h
• piv_ccid.h
• piv_ccid_usb.h
• piv_identity.h

• piv_apdu.c
• piv_ccid.c
• piv_ccid_usb.c
• piv_identity.c

• board_pins.hDW3000-family wiring per ESP32 target, SPI2/FSPI. Source of truth for the
• dw3000_hw.cESP-IDF GPIO/IRQ backend for the DW3000 decadriver — implements dw3000_hw.h.
• dw3000_spi.cESP-IDF SPI backend for the DW3000 decadriver — implements dw3000_spi.h.
• woz_seam_stubs.cThis port's half of modules/woz_uwb/src/driver/uwb_seam.h.

• main.cnRF5340DK on-target self-test for the Aliro device (initiator) EC path: a

• flash.shflash.sh — program the openaliro DWM3001CDK firmware over its on-board J-Link.

• flash.shflash.sh — write the openaliro ESP32 Matter lock to a board with esptool.

• flash.shflash.sh — program both cores of the openaliro nRF5340 DK firmware with nrfutil.

• bootstrap.shbootstrap.sh — build a self-contained west workspace, PRISTINE from upstream.
• build-nrf5340dk.shbuild-nrf5340dk.sh {build|rebuild|flash|flash-erase|build-flash} — build the
• cdk-dfu.shcdk-dfu.sh — push a signed image to the DWM3001CDK over MCUboot serial recovery.
• cdk-rtt-elf-check.shRefuse to attach RTT with an ELF the board is not running.
• cdk-size-baseline.pycdk-size-baseline.py — turn a size report into the committed baseline.
• cdk-size-compare.pycdk-size-compare.py — head against the recorded baseline, as a gate.
• cdk-size-notify.pycdk-size-notify.py — say what a change cost the CDK image, in Discord.
• cdk-size.pycdk-size.py — what the DWM3001CDK image costs, as a machine-readable record.
• check-approtect.shcheck-approtect.sh — refuse to ship an image that locks APPROTECT.
• check-signing-key.shcheck-signing-key.sh — refuse to build a bootloader that anybody can sign for.
• check-uwb-seam.shcheck-uwb-seam.sh — keep the CCC STS seam impossible to bypass.
• deadcode-codechecker.shdeadcode-codechecker.sh — CodeChecker over the real firmware build.
• deadcode-graph.shdeadcode-graph.sh — find functions nothing calls, using the documate code graph.
• deadcode-size.shdeadcode-size.sh — flash cost of the functions nothing calls.
• deadcode-tidy.shdeadcode-tidy.sh — run clang-tidy against the REAL firmware build.
• docs-sync.shdocs-sync.sh — put the generated artifacts back in step after a merge.
• docs.shdocs.sh — build the documentation site into site/.
• flash_html.pyRender a release FLASH.md into a self-contained FLASH.html.
• presence_runtime.pyBuild the minimal, deterministic presence runtime transfer archive.
• release-bundle.shrelease-bundle.sh — assemble one publishable firmware bundle.
• release-notes.shrelease-notes.sh — render the GitHub release body from release/NOTES.md.in.
• security-attest.shsecurity-attest.sh — can somebody who downloaded a release prove where it came from?
• security-ct.shsecurity-ct.sh — secret-dependent branches and table lookups in the CCC key ladder.
• security-diff.shsecurity-diff.sh — the structural half of the malicious-change gate.
• security-fw.shsecurity-fw.sh — the shipped artifact, which every other gate in this repo reasons about only
• security-web.shsecurity-web.sh — the browser half of the supply chain, which nothing else in this repo looks at.
• security-workspace.sh
• security.shsecurity.sh — the four fast security gates, in one place.
• spake2p_verifier.pyDerive a SPAKE2+ verifier (w0 and L) for a Matter setup passcode.
• test-runner.shPretty umbrella runner for every host-side suite: one banner, live per-check
• toolchain.shtoolchain.sh — what the CI gates need, whether this host has it, how to get it.
• twin-suite.shThe web-twin suite for the umbrella runner (make check): the constant-drift
• twin-wasm.shBuild the web twin's firmware: modules/woz_uwb + the tests/host shim compiled
• verify.shPre-push sweep: every CI gate that a host can run, in one shot.
• woz_patch.pyBuild a signed delta patch for the DWM3001CDK's over-the-air update path.
• woz_push.pyPush a signed delta patch to a DWM3001CDK over Bluetooth.
• woz_smp.pyPush a delta patch to the board over SMP, the way a phone would.
• ws-seed.shws-seed.sh — give this git worktree its own NCS workspace, cheaply.

• aliro.lua
• aliro_blob.pyInspect an aliro_prov ("APRV") reader-provisioning blob.
• aliro_gait.pyAliro Gait: carry-motion features from Aliro Lab walk-up captures.
• aliro_lab.pyAliro Lab: score a captured reader serial log.
• docs_3d.pyRender the whole code surface as a flyable 3D graph: site/graph3d.html.
• docs_api.pyFill the reference pages the page generator leaves bare.
• docs_apilinks.pyPoint each narrative page at the declarations it is describing.
• docs_cmds.pyRender runnable command blocks as one copy chip per command.
• docs_flash.pyPublish the browser flasher: site/flash/ = the web-flasher/ page + firmware.
• docs_github.pyPoint the rendered site back at its GitHub repository.
• docs_graph.pyMake the architecture page's dependency graph legible.
• docs_hero.pyStage the site: a cinematic landing hero, and a reveal layer everywhere.
• docs_links.pyRepair cross-document links in the rendered site, then assert none are left broken.
• docs_media.pyAdd the repo's imagery to the rendered site: demo screenshots and a share card.
• docs_modules.pyMove the per-file reference listing off the landing page onto its own.
• docs_motion.pyThe motion layer: choreograph the arrival, and make the page answer back.
• docs_nav.pyGive the rendered site one curated reading order.
• docs_start.pyGive the rendered site a real "Get started" landing.
• docs_theme.pyRetheme the rendered site: warm paper surfaces, serif display headings.
• docs_title.pyTitle the generated pages after the repository, not after the checkout directory.
• docs_twin.pyFold the interactive walk-up digital twin into the rendered site.
• flight_recorder.pyflight_recorder.py — carry a recorded UWB walk-up off the device and turn it
• piv_pin.pyProvision or change the OpenAliro PIV PIN through macOS PC/SC.
• power_profile.pyPower profile: turn a gated-walk-up serial log (+ optional power capture)
• presence_git.pyPresence-signed git tags: prove a human was physically present at a release.
• presence_verify.pyVerify an ECDSA-P256 presence assertion against a dongle's public key.

• app.tsx
• devices.ts
• jobs.ts
• main.tsx
• motion.ts
• search.tsSearching the serial scrollback.
• serial.ts
• targets.ts
• terminal.ts
• theme.ts
• types.ts
• wizard.ts

• check_codes.pyVerify that the Matter commissioning codes shown on the browser flasher page still match the firmware it flashes. Recomp

• check_constants.pyVerify that the web-twin's hardcoded firmware constants in index.html stay synchronized with their source definitions. P
• csp_probe.pyPhase 0 spike, local half.
• twin_glue.c@file twin_glue.c — WASM entry points: the twin page's firmware harness.